Rewterz Threat Alert – Icnanker, a Linux Trojan-Downloader

Severity

High

Analysis Summary

An unknown ELF sample was found generating Elknot botnet related network traffic. It was found to be a Trojan-Downloader which utilizes “SHC (Shell script compiler)” technique and propagates through weak SSH credentials. The author appeared to be an old player Icnanker who leaves his QQ number and name in his codes. Icnanker is the first Linux malware family we observed that uses SHC. Icnanker is divided into 2 categories according to their functions:

• Downloader

Downloader is mainly used to facilitate DDos and Mining attacks. Currently its samples include Elknot Botnet, Xor Botnet and XMRMiner. On Icnanker-related HFS servers, we can see that the current download volume is at 20,114, and about 500 increment per day.

• Protector

Protector is used to protect samples from being deleted. It is currently used to protect Mining service.

Icnanker comes with the following capabilities.

• Download and execute specific samples
• Add new users
• Delete system command
• Hide itself
• Persistence

Impact

• Code execution
• Data manipulation
• Detection Evasion
• DDoS
• Mining

Indicators of Compromise

Hostname

• ubt[.]ubtv[.]xyz
• sys[.]jave[.]xyz
• jav[.]jave[.]xyz
• 8uch[.]jave[.]xyz
• 8uc1[.]jave[.]xyz
• xz[.]jave[.]xyz
• 8uc2[.]ubtv[.]xyz

MD5

• 4a3e1ff8cfc0d334550b815b6d82d89e
• 765a0899cb87400e8a27ab572f3cdd61
• 5c90bfbae5c030da91c9054ecb3194b6
• 187fa428ed44f006df0c8232be4a6e4e
• 89cd1ebfa5757dca1286fd925e0762de
• 5790dedae465994d179c63782e51bac1
• d989e81c4eb23c1e701024ed26f55849
• 0764da93868218d6ae999ed7bd66a98e
• eec19f1639871b6e6356e7ee05db8a94
• 6abe83ee8481b5ce0894d837eabb41df

SHA-256

• 6aba3638f630ca61563ad33503d039db4082c389a270263d34bebefe68a31287
• 400bac87f1303e6ed8b85b009454d8b6cd12fe38337119e03a4c7d0cdb130577
• 741c09277639628acaed49e07ed1f17dea12d613336ff3145c8b224bab033215
• 99a5875ce98349a17224569db4fd86fab9277bca1462744bd3b0ae227ee96e8a
• eebd1648a3d603a26f4c9de11f1ac68e110573388d22a5a65b9daf50116bc5c5
• 2c311b145c1c8e41cf72db978b554f82534a5e3ec6cce5a29d5988d57dbe5fb1
• 4da20ce9dbac55cdddb3497153cf04062347be20a541e8096b42b6094340b5e1
• cf144edc695e4cd84189e4e7230b5cfa7a0a5fb1a15aa397ec8ba085446e245a
• aec62371dbc7e7338c99b0cbc5f09f037d4ebacbfcfad9e844ba71f5053a4d23
• 398b8988661a37761c490bb85c7454bd20f6469b821cbf6d97751348d7cf30c5

URL

• http[:]//xz[.]jave[.]xyz/[.]xm
• http[:]//xz[.]jave[.]xyz/mr[.]tar
• http[:]//xz[.]jave[.]xyz[:]22345/[.]xm
• http[:]//xz[.]jave[.]xyz[:]22345/[.]xm1
• http[:]//jav[.]jave[.]xyz[:]6001
• http[:]//8uc1[.]jave[.]xyz[:]1987
• http[:]//ubt[.]ubtv[.]xyz[:]19880
• http[:]//8uch[.]jave[.]xyz[:]3478
• http[:]//8uc2[.]ubtv[.]xyz[:]2987
• http[:]//xz[.]jave[.]xyz[:]22345
• http[:]//sys[.]jave[.]xyz[:]1764

Remediation

• Block the threat indicators at their respective controls.
• Use unique and strong credentials and implement multi-factor authentication.